Measurement-device-independent quantum key distribution (MDI-QKD) is a method of distributing secret keys that can be immune to detector side channel attacks. The scheme includes at least two sending chips (usually referred to as Alice and Bob), which encode signals in single photons through either time-bin encoding or polarization encoding, as well as a receiver chip (usually referred to as Charlie), which measures the signals in the maximally-entangled Bell basis.
To implement the MDI-QKD protocol, Alice and Bob randomly and independently prepare photon signals in one of the four BB84 states: |0, |1 in the Z-basis, or |+, |− in the X-basis. These photons are then sent via the quantum channel to Charlie who is instructed to perform a Bell state measurement. The four Bell states are summarized in Table 1. Alice and Bob can also apply the decoy state protocol to their photon signals to estimate the gain (i.e., the probability that Alice and Bob's signals yield a successful Bell measurement) and the quantum bit error rate (QBER, the rate of false successful Bell measurements due to single photon contributions).
Charlie announces whether or not his Bell state measurements are successful along with the Bell state obtained. Alice and Bob retain only the data that correspond to successful Bell state measurements and discard the rest. For the data they retained, Alice and Bob each reveal their basis choices over the public channel and retain only those instances where they chose the same basis. Bob then flips parts of his data to directly correlate his measurements with those of Alice. Finally, Alice and Bob apply error correction and privacy amplification to establish identical secret keys.
TABLE 1The four Bell states and possible bit flipsto directly correlate Alice and Bob's bitsBell state reported by Charlie|ψ−> =|ψ+> =|φ−> =|φ+> =Basis chosen by(|01> −(|01> +(|00> −(|00> +Alice and Bob|10>)/{square root over (2)}|10>)/{square root over (2)}|11>)/{square root over (2)}|11>)/{square root over (2)}Z basisFlipFlip——X basisFlip—Flip—
The rate of secret key generation (in bits per second, per Bell state), in the limit of large number of signals exchanged for each Bell state |k>ε{|φ+>, |φ−>, |ψ+>, |ψ−>} is
                              R                                  k            〉                          ≥                  r          ⁢                      {                                          Q                ⁢                                                                            1                      ,                      1                                                              z                      ,                                                                      k                        〉                                                                              ⁡                                      [                                          1                      -                                                                        H                          2                                                ⁡                                                  (                                                      e                            ⁢                                                                                          1                                ,                                1                                                                                            x                                ,                                                                                                    k                                  〉                                                                                                                                              )                                                                                      ]                                                              -                              Q                ⁢                                                      vsa                    ,                    vsb                                                        z                    ,                                                                k                      〉                                                                      ⁢                                  fe                  ⁡                                      (                                          E                      ⁢                                                                        vsa                          ,                          vsb                                                                          z                          ,                                                                                  k                            〉                                                                                                                )                                                  ⁢                                  (                                                            H                      2                                        ⁢                                                                  vsa                        ,                        vsb                                                                    z                        ,                                                                            k                          〉                                                                                                      )                                                      }                                              (        1        )            where r is the repetition rate in Hz
  Q  ⁢            1      ,      1              z      ,                      k        〉              ⁢          ⁢  and  ⁢          ⁢            1      ,      1              x      ,                      k        〉            are the gain and QBER due to single photon signals;
  Q  ⁢            vsa      ,      vsb                      z        ,                  ❘          k                    〉        ⁢          ⁢  and  ⁢          ⁢  e  ⁢            1      ,      1                      x        ,                  ❘          k                    〉      are the gain and QBER for signals emitted by Alice and Bob with mean photon number Vsa and Vsb, respectively; fe≥1 is the error correction inefficiency; H2 (x)=−x log2 x−(1−x)log2(1−x) is the binary entropy function. The equation for the secret key generation rate assumes that Alice and Bob use the Z-basis for key generation and only use the X-basis for security checks. The quantities
  Q  ⁢            vsa      ,      vsb                      z        ,                  ❘          k                    〉        ⁢          ⁢  and  ⁢          ⁢  E  ⁢            vsa      ,      vsb                      z        ,                  ❘          k                    〉      can be measured directly as the MDI-QKD system is run, while the quantities
  Q  ⁢            1      ,      1                      z        ,                  ❘          k                    〉        ⁢          ⁢  and  ⁢          ⁢  e  ⁢            1      ,      1                      x        ,                  ❘          k                    〉      can be measured using the decoy-state protocol.
A more detailed description of the protocol with two decoy states is as follows. The protocol can be performed with more than two decoy states, but in practice it can be desirable to have as few decoy states as possible. The first four steps of the protocol—state preparation, state distribution, Bell state measurement, and sifting—are repeated N times until the successful sifting conditions are met.
Step 1: State preparation. Alice and Bob randomly and independently choose an intensity for their photon signals: Va∈{Vsa, Vda,1, Vda,2} for Alice and Vb∈{Vsb, Vdb,1, Vdb,2} for Bob. Vsa(Vsb) corresponds to the intensity of the signal state for Alice (Bob) and Vda,i, (Vdb,i) for 1,2 corresponds to the intensity of the decoy states for Alice (Bob). The two decoy states typically have weaker intensities than the signal state. Alice and Bob then randomly and independently choose a basis Bi∈{Z,X}, and a bit ri∈{0,1} with probability of Pvi,ri/2 for i=a (Alice) or b (Bob). They then prepare a quantum signal of intensity vi encoding qubit |ri> in basis Bi for both i=a or b.
Step 2: State distribution. Alice and Bob send their prepared quantum signals to Charlie via the quantum channel.
Step 3: Bell state measurement. If Charlie is not an adversary to Alice and Bob, he then measures the quantum signals received in the maximally-entangled Bell basis. Charlie then announces whether or not his measurement is successful, including the Bell state obtained.
Step 4: Sifting. If Charlie announces a successful Bell measurement, Alice and Bob then announce their intensity and basis choices. For each Bell state |k>∈{|φ+>, |φ−>, |ψ+>, |ψ−>}, Alice and Bob bin their data in
  Z  ⁢            va      ,      vb                      ❘        k            〉        ⁢          ⁢  and  ⁢          ⁢  X  ⁢            va      ,      vb                      ❘        k            〉      according to their intensity and basis choices. The first four steps of the protocol are repeated until
            Z      ⁢                        va          ,          vb                                      ❘            k                    〉                      ❘                  ≥                  N          ⁢                                    va              ,              vb                                                      ❘                k                            〉                                ⁢                                          ⁢          and                    ⁢                          ❘                        X          ⁢                                    va              ,              vb                                                      ❘                k                            〉                                      ❘                  ≥                      M            ⁢                                          va                ,                vb                                                              ❘                  k                                〉                                                          ,where
  N  ⁢            va      ,      vb                      ❘        k            〉        ⁢          ⁢  and  ⁢          ⁢  M  ⁢            va      ,      vb                      ❘        k            〉      are chosen such that large enough statistical samples for the post-processing steps are available. Bob then corrects his data by flipping parts of his bits according to Table 1 so that his data are directly correlated with Alice's data.
Step 5: Post-processing. Post-processing is performed independently for each Bell state |k>∈{|φ+>, |φ−>, |ψ+>, |ψ−>}. This step can include several sub-steps, including:
Step 5a: Parameter estimation. Alice and Bob choose a random subset of
  Z  ⁢            vsa      ,      vsb                      ❘        k            〉      and store the respective bit strings Z|k> and Z|k>′, respectively. They then use the remaining bits R|k> of
  Z  ⁢            vsa      ,      vsb                      ❘        k            〉      to compute the QBERs
            E      ⁢                        vsa          ,          vsb                                      ❘            k                    〉                      =                            1                                                                  R                ❘                k                            〉                                                  ⁢                  Σ          l                ⁢                  r          l                    ⊕              r        l        ′              ,where rl′ are Bob's bits. If
  E  ⁢            vsa      ,      vsb                      ❘        k            〉      is higher than the QBER tolerance, Alice and Bob then abort any subsequent steps for this particular |k>. The whole protocol only aborts if
  E  ⁢            vsa      ,      vsb                      ❘        k            〉      is higher than the allowed QBER tolerance for all four choices of |k>. If
  E  ⁢            vsa      ,      vsb                      ❘        k            〉      is within the allowed QBER tolerance, then Alice and Bob use
  Z  ⁢            vsa      ,      vsb                      ❘        k            〉        ⁢          ⁢  and  ⁢          ⁢  X  ⁢            vsa      ,      vsb                      ❘        k            〉      to estimate the values of
      Q    ⁢                  1        ,        1                              z          ,                      ❘            k                          〉              ,      e    ⁢                  1        ,        1                              x          ,                      ❘            k                          〉              ⁢                  ⁢    and    ⁢                  ⁢    Q    ⁢                  vsa        ,        vsb                              z          ,                      ❘            k                          〉            for this particular |k>).
Step 5b: Error correction. If this particular |k> passes the parameter estimation step, Bob obtains an estimate {circumflex over (Z)}|k> of Z|k> using an information reconciliation scheme, which requires Alice to leak some information of Z|k>. Alice then computes a hash of Z|k> using a random universal hash function, which is sent to Bob along with the value of the hash. Bob then computes the hash of {circumflex over (Z)}|k> and aborts the protocol for this particular |k> if the hash of {circumflex over (Z)}|k> disagrees with the hash of Z|k>.
Step 5c: Privacy amplification. If this particular |k> passes the error correction step, Alice and Bob apply another random universal2 hash function to Z|k> and {circumflex over (Z)}|k> to obtain the (shared) secret key, respectively.
Currently, the above MDI-QKD protocol is implemented with bulk optical components. One drawback of bulk optical systems is that they usually use manual assembly of many parts (e.g., mirrors, phase modulators, lenses, etc.). It can also be challenging to make bulk optical systems mechanically stable to guard against component misalignment due to vibration and temperature variations.